Bump pipenv from 2026.7.1 to 2026.8.0

[dependabot]

Bumps pipenv from 2026.7.1 to 2026.8.0.

Release notes

Sourced from pipenv's releases.

Release v2026.8.0

🤖 AI-Generated Changelog

Added

• Parallel index manifest prefetching (PIPENV_PREFETCH_INDEX_MANIFESTS): New experimental feature that fetches package index manifests concurrently during lock operations, significantly reducing resolution time for large dependency sets
• PEP 691 JSON Simple API support: Native parsing of PEP 691 JSON responses from package indexes alongside existing PEP 503 HTML parsing
• Disk-based manifest cache (ParsedManifestCache): JSON-on-disk cache with TTL and atomic writes to avoid redundant index fetches across lock operations
• Pluggable resolver backend scaffolding: Foundation for swappable resolver backends, enabling future customization of dependency resolution strategies
• Per-source verify_ssl fan-out for prefetcher: Each index source now independently respects its SSL verification and certificate settings during parallel prefetch
• peek_etag stale-cache short-circuit: Resolver can now skip full manifest fetches when ETags indicate cached data is still fresh
• prefetch_index_manifests setting: New boolean configuration option to enable/disable the parallel prefetch feature
• Reject Pipfile entries with unrecognized keys, providing clearer errors on misconfiguration

Changed

• Pipfile subsystem extracted from Project: Internal refactor completing Initiative D; project.build_script and related attributes now live on project.pipfile
• Lockfile subsystem extracted from Project: Lockfile state management is now a dedicated subsystem
• unpack_url / get_http_url moved to pipenv/utils/unpack.py; legacy requirementslib.py removed
• Resolver backend selection is now stamped onto resolver requests for improved traceability
• Prior Pipfile.lock pins are fed as pip constraints on warm relock to speed up re-locking (reverted and re-landed with fixes)
• Resolver subprocess skipped entirely for empty Pipfile categories, reducing unnecessary process overhead
• Vendor pip updated to 26.2.1

Fixed

• Corrupt lockfile recovery: Fixed return path when recovering from a corrupt lockfile
• Editable VCS extras now resolve correctly with pip 26.2
• netrc login handling: Quote-only netrc credentials are now treated as empty on Python 3.10+, preventing auth failures
• Manifest cache retry on Windows: os.replace is retried on ERROR_ACCESS_DENIED with a wall-clock budget, fixing cache write failures on Windows
• Missing Pipfile hashes are now handled gracefully instead of raising an error
• Plette Pipfile attribute delegation fixed after subsystem refactor
• resolver_backend is now correctly plumbed through the venv_resolve_deps call chain
• Prerelease versions are now allowed as a fallback at final lower bounds
• Stale project.build_script call sites migrated to project.pipfile.build_script
• Test for Pipfile version warning updated after subsystem extraction
• test_lockfile_location_is_pipfile_plus_lock made OS-portable
• Fixed latest hash and virtualenv guidance in documentation/output
• Fixed first-party CodeQL reliability errors
• Deferred pip-internal imports (InstallCommand, unpack, Downloader, network imports) to improve startup performance

Security

• CodeQL reliability improvements to reduce false negatives in static analysis

---

🔗 Full Changelog: pypa/pipenv@v2026.7.1...v2026.8.0

Changelog

Sourced from pipenv's changelog.

2026.8.0 (2026-08-20)

pipenv 2026.8.0 (2026-08-20)

Features & Improvements

• Pipenv now includes scaffolding for pluggable resolver backends. The --resolver NAME CLI flag, PIPENV_RESOLVER environment variable, and [pipenv] resolver Pipfile setting are now recognized, but only pip (the default) is shipped in this release. Selecting an unknown backend will produce a clear error message. Future releases will add additional backends. #T_F.5 <https://github.com/pypa/pipenv/issues/T_F.5>_
• Add a pure-Python PEP 691 / PEP 503 simple-API client + parsed-manifest cache + parallel fetcher under pipenv/resolver/. Initiative G phase 1 ships the standalone surface; no integration yet. Phase 2 (cache-prime bridge) and Phase 3 (full backend) will wire it in. pipenv lock --clear and pipenv install --clear now invalidate this parsed-manifest cache in addition to pip's HTTP cache. #initiative-g-phase1-pep691-client <https://github.com/pypa/pipenv/issues/initiative-g-phase1-pep691-client>_
• Add [pipenv] prefetch_index_manifests opt-in setting (also PIPENV_PREFETCH_INDEX_MANIFESTS=1) that pre-fetches simple-API index pages for top-level Pipfile packages in parallel before the resolver runs. Most beneficial on cold caches or slow networks; off-by-default because warm-cache dev machines see neutral-to- slightly-slower behaviour. Initiative G phase 2. #initiative-g-phase2-prefetch-bridge <https://github.com/pypa/pipenv/issues/initiative-g-phase2-prefetch-bridge>_

Bug Fixes

• Fixed corrupt Pipfile and lockfile errors so they retain the affected path and backup location while reporting the file-specific error message.
• Allow dependency locking to fall back to a prerelease of a final lower bound, such as resolving odin~=2.11 to 2.11rc3 before the 2.11 final release is available. [#6701](https://github.com/pypa/pipenv/issues/6701) <https://github.com/pypa/pipenv/issues/6701>_
• Python-version mismatch warnings now recommend pipenv remove instead of the deprecated pipenv --rm flag. [#6704](https://github.com/pypa/pipenv/issues/6704) <https://github.com/pypa/pipenv/issues/6704>_
• Hash-lookup sessions now use pip's combined certificate trust configuration, so custom CA bundles do not discard the public roots trusted by pip. [#6711](https://github.com/pypa/pipenv/issues/6711) <https://github.com/pypa/pipenv/issues/6711>_
• PyPI hash collection now handles requests and pip network exceptions and falls back to the resolver's other hash sources. [#6712](https://github.com/pypa/pipenv/issues/6712) <https://github.com/pypa/pipenv/issues/6712>_

Vendored Libraries

• Updated the bundled pip to 26.2.
• Updated the bundled pip to 26.2.1.

Commits

• 2a37cdb Release v2026.8.0
• 2b855a4 Bumped version to 2026.8.0.
• 200082a Merge pull request #6668 from pypa/maintenance/code-cleanup-phase5-perf-2026-06
• 5cdd812 Address final Phase V review feedback
• d1248c2 Document best-effort cache cleanup
• f798b2e Address additional resolver code quality feedback
• c610fb9 Adapt truststore test to lazy imports
• 0fa2c19 Address manifest cache test review feedback
• 6c1f520 fix(tests): validate prefetch source hostnames structurally
• 1067385 fix(resolver-auth): treat quote-only netrc login as empty on Python 3.10
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud